NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
HIGH severity

Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacksGHSA-95fc-g4gj-mqmx

HIGH

GHSA-95fc-g4gj-mqmx is a high-severity (CVSS 8) CWE-295 vulnerability in github.com/rancher/steve. A fix is available for github.com/rancher/steve — see the affected versions and patch details below.

Also known asCVE-2023-32198GO-2025-3648
Published
Updated
Affected
4 pkgs
Patched
4 / 4
Exploits
None indexed
Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-95fc-g4gj-mqmx.

EPSS Exploitation Probability

via FIRST.org ↗
0.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs26th percentile — riskier than 26% of all scored CVEsHighest risk
0.00%0.28%0.55%0.83%0.3%0.3%Nov 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

4 pkgs affected
🐹github.com/rancher/steve🐹github.com/rancher/steve🐹github.com/rancher/steve🐹github.com/rancher/steve

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

For example, Rancher relies on Steve as a dependency for its user interface (UI) to proxy requests to Kubernetes clusters. Users who have the permission to create a service in Rancher’s local cluster can take over Rancher’s UI and display their own UI to gather sensitive information. This is only possible when the setting ui-offline-preferred is manually set to remote (by default Rancher sets it to dynamic). This enables further attacks such as cross-site scripting (XSS), or tampering the UI to collect passwords from other users etc.

Please consult the associated MITRE ATT&CK - Technique - Adversary-in-the-Middle for further information about this category of attack.

Patches

Patched versions of Steve include releases v0.2.1, v0.3.3, v0.4.4 and v0.5.13.

This vulnerability is addressed by changing Steve to always verify a server’s certificate based on Go’s TLS settings.

Workarounds

If you can't upgrade to a fixed version, please make sure that you are only using Steve to connect to trusted servers.

References

If you have any questions or comments about this advisory:

Affected Packages

4 total 4 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/rancher/steve≥ 0.2.0&&< 0.2.10.2.1go get github.com/rancher/steve@v0.2.1
🐹Gogithub.com/rancher/steve≥ 0.3.0&&< 0.3.30.3.3go get github.com/rancher/steve@v0.3.3
🐹Gogithub.com/rancher/steve≥ 0.4.0&&< 0.4.40.4.4go get github.com/rancher/steve@v0.4.4
🐹Gogithub.com/rancher/steve≥ 0.5.0&&< 0.5.130.5.13go get github.com/rancher/steve@v0.5.13

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/rancher/steve, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/rancher/steve to 0.2.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-95fc-g4gj-mqmx is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Impact A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve. For example, Rancher relies on Steve as a dependency for its user interface (UI) to proxy requests to Kubernetes clusters. Users who have the permission to create a service in Rancher’s local cluster can take over Rancher’s UI and display their own UI to gather sensitive information. This is
O3 Security · Impact-Aware SCA

Is GHSA-95fc-g4gj-mqmx in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
Steve doesn’t verify a server’s certificate and is…